Privacy Notice (KVKK)
We explain which personal data we process when you make a booking request, stay with us and use our website, for what purposes and on what legal grounds, to whom we may transfer it, and your rights under the Personal Data Protection Law No. 6698 (KVKK).
Last updated: 22 October 2026
At Royal Palace Butik Otel, we care about the security of your personal data. This privacy notice has been prepared pursuant to Article 10 of the Personal Data Protection Law No. 6698 (“KVKK”) to explain for what purposes and on what legal grounds your personal data is processed when you use our website, make a booking request and stay at our hotel, to whom it may be transferred, and what your rights are.
1. Data controller
Your personal data is processed by the following business in its capacity as data controller:
- Business: Royal Palace Butik Otel
- Address: Metin Göktepe Caddesi, Kuruçeşme, 202/5. Sk. No:24, 35390 Buca/İzmir, Türkiye
- Email: royalpalacehotel35@gmail.com
- Phone: +90 232 454 25 81
2. Personal data we process
| Data category | Data | Source |
|---|---|---|
| Identity | Full name; during your stay, the information on your identity document (including your Turkish identity number or passport details) | Booking form, WhatsApp, reception |
| Contact | Phone number, email address (optional), WhatsApp and email correspondence | Booking form, WhatsApp, phone, email |
| Customer transaction | Request number, selected room, check-in and check-out dates, number of adults and children, the note in your request, the total amount displayed, request and booking status | Booking form, WhatsApp, reception |
| Finance | Records of payments made at the hotel and documents issued as required by law | Reception |
| Physical premises security | Security camera recordings from the hotel’s common areas | Camera system |
| Transaction security | IP address, browser and device information, access logs | Website infrastructure |
| Marketing | Your explicit consent preference for campaign and announcement communications; if you give cookie consent, campaign source information (UTM parameters, ad click identifiers), the page through which you entered the site and the referring site | Booking form, cookies |
3. Purposes of processing
- To receive your booking request, provide availability and price information, assess your request and get back to you via WhatsApp;
- To confirm your booking, provide the accommodation service and carry out check-in, check-out and payment procedures;
- To fulfil legal obligations such as identity notification under the Identity Notification Law No. 1774 and tax legislation;
- To ensure the physical security of our guests, our employees and the hotel;
- To ensure the information security of the website and prevent misuse;
- To respond to your requests, complaints and suggestions, and to exercise our legal rights in the event of a dispute;
- To send you our campaigns and announcements if you give explicit consent;
- To measure the use of the website and improve our services if you give cookie consent.
4. Legal grounds
Your personal data is processed on the following legal grounds set out in Article 5 of the KVKK:
- Establishment or performance of a contract (Art. 5(2)(c)): receiving and assessing booking requests and providing the accommodation service;
- Compliance with a legal obligation (Art. 5(2)(ç)): identity notification, tax and accounting records, requests from competent authorities;
- Establishment, exercise or protection of a right (Art. 5(2)(e)): retaining records in case of potential disputes;
- Legitimate interest (Art. 5(2)(f)): use of security cameras in common areas, website security and maintaining service quality;
- Explicit consent (Art. 5(1)): campaign and announcement communications, analytics and advertising cookies, and transfers abroad where explicit consent is required.
5. Transfer of personal data
Your personal data is not sold. It may be transferred to the following recipients for the purposes above and to the extent necessary:
- Authorised public institutions and organisations: law enforcement authorities under the Identity Notification Law, tax offices and, upon request, judicial authorities;
- Hosting service: our website and booking records are hosted on Hetzner Online GmbH servers located in Germany;
- Messaging and email: because you send your booking request from your own WhatsApp account, your messages are transmitted via WhatsApp (Meta Platforms) infrastructure; email correspondence is handled on Google infrastructure;
- Web analytics: Google Analytics (Google LLC), only if you give cookie consent.
As the servers of some of these service providers are located abroad, these transfers are carried out in accordance with the conditions laid down in Article 9 of the KVKK (e.g. a standard contract or explicit consent).
6. How personal data is collected
Your personal data is collected by automated or partly automated means through the booking form on our website, WhatsApp, phone, email, procedures at reception, security cameras and cookies.
7. Retention periods
- Personal data in booking requests made through our website is automatically anonymised after no more than 2 years. Requests for which no WhatsApp message is sent are deemed invalid after 24 hours.
- Accommodation, identity notification, payment and invoice records are kept for the periods laid down in the relevant legislation.
- Security camera recordings are kept for a limited period for security purposes and are deleted at the end of that period.
- The retention periods of cookies are set out in our Cookie Policy.
Data whose retention period has expired is deleted, destroyed or anonymised.
8. Your rights
Under Article 11 of the KVKK, by applying to the data controller you have the right to:
- Learn whether your personal data is processed;
- Request information about the processing if your personal data has been processed;
- Learn the purpose of the processing and whether the data is used in line with that purpose;
- Know the third parties in Türkiye or abroad to whom your personal data is transferred;
- Request rectification if your personal data has been processed incompletely or inaccurately;
- Request the erasure or destruction of your personal data under the conditions set out in Article 7 of the KVKK;
- Request that rectification, erasure and destruction be notified to the third parties to whom your data has been transferred;
- Object to a result to your detriment arising from the analysis of the processed data exclusively by automated systems;
- Claim compensation for damage you suffer as a result of unlawful processing.
You may withdraw the explicit consent you have given for campaigns and announcements at any time; you can change your cookie preferences via the “Cookie preferences” link at the bottom of the page.
9. Applications
You can submit requests concerning your rights, together with information verifying your identity, by emailing royalpalacehotel35@gmail.com or in writing to the address above. Your application will be concluded within 30 days at the latest in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller; as a rule, the process is free of charge.
For details on the use of our website, please see our Privacy Policy and Cookie Policy.